Latest news, tutorials, and insights by Keith J. Jones, PhD.
In this video, Keith Jones (Sr. Security Researcher, Corelight) introduces a simple Python program written to help you take your Zeek ASCII tab delimited files and make them full text searchable with ElasticSearch+Kibana (or OpenSearch, if…
read more about Zeek In Action, Video 12, zeek2esIn this video, Keith Jones (Sr. Security Researcher, Corelight) builds on a previous Zeek in Action video and shows how you can use spicy-driver to quickly debug (and improve!) the Radius code we built in that…
read more about Zeek in Action, Video 11, Using Spicy DriverIn this Zeek in Action video, Keith Jones explains his Spicy protocol analyzer rapid development process on a new Radius analyzer. Of course Radius is in core Zeek, but it can be replaced with a Spicy…
read more about Zeek In Action, Video 9, Radius Protocol Analyzer with SpicyIntroduction In April 2021 Juniper networks reported on a new Linux rootkit designed to steal SSH credentials from Linux servers. A month later Netlab 360 published a deeper analysis of the same rootkit they named “Facefish”. …
read more about Detecting the Facefish Linux Rootkit with ZeekIntroduction I previously blogged about the Zeek OpenVPN Binpac and Spicy protocol analyzers, but that is only one quarter of the popular VPN protocols I see on networks I monitor. The four main VPN protocols, in…
read more about Zeek’s IPSec Protocol AnalyzerIntroduction and Background I last wrote about detecting OpenVPN with Zeek, and to understand this blog you should familiarize yourself with that post. This blog will not repeat the basics of OpenVPN, but instead it will…
read more about A Zeek OpenVPN Protocol Analyzer in SpicyBy Keith J. Jones, Corelight Sr. Security Researcher Introduction and Background Many modern VPN providers use the OpenVPN protocol in their clients and servers. Threat actors are also known to use OpenVPN. Zeek is unable to…
read more about A Zeek OpenVPN Protocol AnalyzerIntroduction This blog post will walk you through the process of adding a JPEG file analyzer to Zeek. Please keep in mind that our main goal in this blog series is to “teach a person to…
read more about How To Add A JPEG File Analyzer To Zeek – Part 1